Privacy Policy

Privacy Policy in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Articles 13 and 21 of the GDPR of PALUX Aktiengesellschaft

We at PALUX are delighted by your interest in our company and our products and thank you for visiting our website.

The protection of personal data is of paramount importance to the management of PALUX Aktiengesellschaft, and therefore the protection of your privacy when using our websites is a matter of great concern to us.

Below, we would like to inform you about the collection and processing of personal data that may be associated with the use of our website and about the rights of data subjects in this context. Definitions of some of the terms used below can be found below.

I. Name and address of the data controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature in connection with the use of our website https://www.palux.de and the associated social media presences is the

PALUX Aktiengesellschaft
Wilhelm-Frank-Straße 36
97980 Bad Mergentheim
Germany
Phone: +49 7931 55 0
Email: info@palux.de
Website: https://www.palux.de

This responsibility does not extend to the websites of other providers that may be linked to from PALUX websites.

II. Address of the Data Protection Officer

If you have any questions about this privacy policy, your rights to information, or our data protection practices on the web, please contact:

PALUX Aktiengesellschaft
Data protection officer
Wilhelm-Frank-Straße 36
97980 Bad Mergentheim
Phone: +49 7931 55 0
Email: Data protection officer@palux.de

III. Collection, processing and use of personal data by automated means in connection with the use of our website, as well as the type and purpose of the use

a. SSL encryption
For security reasons and to protect the transmission of personal data via our website, such as your inquiries to us, we use SSL encryption. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the padlock symbol at the beginning of your browser's address bar. All data transmitted using this technology is encrypted before being sent to us. We also store the IP address of the requesting system to protect our users and ourselves from misuse.

b. Storage in log files
When you access our website, a number of general data and information are stored in log files on our web server. Specifically, the following may be recorded:

1. the IP address of the requesting device (PC, tablet, smartphone),
2. the operating system used by the calling system,
3. the browser type and version used
4. the website from which the calling system accesses our website (so-called referrer),
5. the other websites which are accessed by a calling system on our website,
6. the date and time of a visit to our website,
7. the Internet service provider of the calling system,
8. other comparable data and information that serve to avert danger in the event of attacks on our server systems and to prosecute in the event of misuse.

We do not link this stored data to the data subject. The processing of this log file data serves to ensure the correct delivery of our website content, to guarantee the functionality of our IT systems, and to improve the content of our websites and the associated advertising.

In the event of misuse or cyberattacks on our systems, we can provide the authorities with the information necessary for prosecution based on these log files.

Should we also use the log files to create user profiles, whether for advertising, market research, or to tailor our website to user needs, the IP addresses will be anonymized beforehand. Otherwise, the IP addresses will be deleted from the log files. As a result, you will always remain anonymous, even with the automatic collection and temporary storage of your IP address. The server log file data is always stored separately from personal data.

c. Use of cookies

Without your consent, we only use cookies that are technically essential for the operation of the website (e.g., session cookies, storage of your cookie preferences). The legal basis for this is Section 25 Paragraph 2 No. 2 of the German Telemedia Act (TDDG) in conjunction with Article 6 Paragraph 1 Letter f of the GDPR.

All other cookies and external content will only be loaded if you have given your consent (Section 25 Paragraph 1 TDDDG, Article 6 Paragraph 1 Letter a GDPR). A complete overview of all cookies and services used, including their storage duration, can be found at the end of this privacy policy in the section "Cookies and Consent Management".

d. Contact form
Our website includes a contact form which can be used for electronic communication.

When you submit inquiries to PALUX Aktiengesellschaft via the contact form, the personal data you voluntarily provide, including your inquiry from the contact form, will be automatically stored by PALUX Aktiengesellschaft solely for the purpose of processing your inquiry and for any follow-up questions. To process your specific inquiry, we may transfer your personal data to one or more data processors or forward it to a sister company of PALUX Aktiengesellschaft, such as SERVATOR ServiceLine GmbH.

Alternatively, you can send us your questions by email to the following address: info@palux.de

By registering on our website, the IP address of the data subject, the date, and the time of registration are also stored. This data is stored to prevent misuse of our services and to enable us to investigate criminal offenses if necessary. Therefore, storing this data is necessary to protect the data controller.

e. Seminar registration
Within our website there is a registration form for participation in the seminars we offer, which can be used for electronic registration.

When you register for a seminar with PALUX AG using the registration form, the personal data you voluntarily provide will be automatically stored solely for the purpose of processing your registration and sending you further information from PALUX AG. To register your application, we require the information in the fields marked as mandatory on the electronic registration form. If you do not wish to provide this information, we cannot process your registration and will not be able to allow you to participate in the seminars.

Alternatively, you can send your registration to us by email at: info@palux.de

By registering on our website, the IP address of the data subject, the date, and the time of registration are also stored. This data is stored to prevent misuse of our services and to enable us to investigate criminal offenses if necessary. Therefore, storing this data is necessary to protect the data controller.

IV. Legal basis for processing

• Article 6 paragraph 1 letter a GDPR serves as the legal basis for processing operations where we obtain consent for a specific processing purpose.
• If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, the processing is based on Article 6(1)(b) GDPR. The same applies to pre-contractual measures.
• If we are subject to a legal obligation, such as fulfilling tax obligations, the processing is based on Art. 6 para. 1 lit. c GDPR.
• Further processing operations may be based on Art. 6 para. 1 lit. f GDPR if there is a legitimate interest of PALUX Aktiengesellschaft or a third party.

V. Third-party services

GTranslate (language versions)

Provider: GTranslate Inc., 4394 NW 120th Ave, Coral Springs, FL 33065, USA.
Purpose: Language switcher (EN/FR). Translation via GTranslate only occurs after you select a language. No data is sent to GTranslate or Google when the page is loaded; the flags originate from this website.
Legal basis: Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG (consent).
Privacy Policy: https://gtranslate.io/privacy-policy

 Google reCAPTCHA

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: To protect forms from spam.
Legal basis: Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG (consent).
Privacy Policy: https://policies.google.com/privacy

WP Dark Mode

Provider: Operator of this website.
Purpose: Remembers the selected light/dark mode.
Legal basis: Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG (consent).
Data protection: –

Specifi E-Catalog

Provider: Specifi Europe srl, Italy (Group: Specifi LLC, USA).
Purpose: Integration of the interactive product catalog.
Legal basis: Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG (consent).
Privacy Policy: https://de.specifiglobal.com/privacy-policy/

Palux Bot (AI chat)

Provider: Odenwald IT Service UG (limited liability), Schefflenzer Str. 3, 74743 Seckach – Data processor, operated on servers of Mittwald CM Service GmbH & Co. KG in Germany.
Purpose: AI assistant for questions about products and services. Your messages are processed exclusively on servers in Germany and will not be shared with third parties.
Legal basis: Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG (consent).
Data protection: –

IPinfo – Geolocation API

Provider: IPinfo, Inc., 1500 Broadway, Suite 1100, New York, NY 10036, USA.
Purpose: To determine the visitor's country code for pre-filling the telephone country code field.
Legal basis: Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG (consent).
Privacy Policy: https://ipinfo.io/privacy

Consent management with cookieblocker

To obtain and manage your consent, we use the cookieblocker service ( https://cookieblocker.de ) provided by Odenwald IT Service UG (limited liability), Schefflenzer Straße 3, 74743 Seckach, Germany. cookieblocker ensures that services requiring consent are only loaded after you have given your consent. The service is operated exclusively in Germany; the consent banner is delivered directly from our own server. Details regarding the stored data, storage duration, and your options for withdrawing your consent can be found in the "Cookies and Consent Management" section at the end of this privacy policy.

VI. Hosting and technical support

Our website is technically maintained and hosted by an external service provider, Odenwald IT Service UG (limited liability) , Schefflenzer Straße 3, 74743 Seckach. The servers are located in the data center of Mittwald CM Service GmbH & Co. KG , Königsberger Straße 4–6, 32339 Espelkamp, ​​which acts as a sub-processor. Data processing takes place exclusively in Germany.

The personal data collected on this website is stored on these servers. This may include, in particular, IP addresses, contact requests, contract data, contact information, website access data, and other data generated via the website. This data is used for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Art. 6 para. 1 lit. f GDPR).

We have concluded a data processing agreement (Art. 28 GDPR) with Odenwald IT Service UG. They process your data exclusively to the extent necessary for fulfilling the contractually agreed services and always in accordance with our instructions. You can find Odenwald IT Service UG's privacy policy here: https://odenwald-it-service.de/datenschutz.html

VII. Collection and processing of personal data in applications and the application process

For the purpose of processing applications for employment at PALUX Aktiengesellschaft, we collect and process personal data from applicants.

Processing can also be carried out electronically. In particular, this applies if the applicant sends the application documents electronically, for example by email, to the data controller via the separate email address we have provided for applications.

If an employment relationship is established with the applicant after the selection process has been completed, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with legal regulations.

If no employment relationship is established with the applicant, the application documents will be automatically deleted after notification of the rejection decision, unless other legitimate interests of the data controller preclude deletion. A legitimate interest in this sense is, for example, preserving the possibility of presenting evidence in potential legal proceedings under the General Equal Treatment Act (AGG).

In addition, we may store the applicant's application documents based on separate voluntary consent for a possible later need.

VIII. Duration for which the personal data will be stored

The criterion for the duration of storage of personal data is the respective statutory retention period. After this period expires, the corresponding data is routinely deleted, unless and to the extent that it is still required for contract fulfillment or initiation, or the legitimate interests of the controller outweigh the data subject's interest in erasure – e.g., access to order documents and related technical documentation for service purposes or for processing follow-up inquiries regarding previous installations. Since the customer's usage period of our products regularly exceeds the statutory retention periods, this constitutes a legitimate interest of the controller to continue storing these documents. The documents may also be stored permanently to safeguard legal defense options and liability insurance coverage, particularly with regard to product liability for our products. If such a legitimate interest ceases to exist at a later date, this data will also be routinely deleted.

IX. Disclosure of personal data

We only disclose personal data to third parties if there is a legal basis for doing so under data protection law. This may be the case, for example, according to Section IV of this Privacy Policy. Third parties may also include external service providers who process personal data on our behalf and only within the framework of strictly instructed data processing agreements. Data processing outside the EU or the EEA generally does not take place. Should such a data transfer be necessary in a specific case, it will only occur on the basis of the EU Standard Contractual Clauses or to countries for which the EU has issued an adequacy decision, and only within the framework of data processing agreements.

X. Rights of data subjects

Data subjects have the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed. If this is the case, the data subject has the right to...

• In accordance with Article 7 Paragraph 3 GDPR, you have the right to withdraw your consent at any time with effect for the future;
• In accordance with Article 15 GDPR, information about
  • the processing purposes,
  • the categories of personal data processed,
  • the recipients or categories of recipients to whom the personal data have been disclosed,
  • the planned storage duration of the data or the criteria for determining the storage duration,
  • the right to rectification or erasure of the data or to restriction of processing by the controller or to object to such processing,
  • the existence of a right of appeal,
  • the origin of their data, unless it was collected from the data subject themselves,
  • as well as to request information about the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its process;
• pursuant to Art. 16 GDPR
  • the correction of inaccurate personal data,
  • with regard to the purposes for which the data were processed, to request the completion of incomplete personal data;
• In accordance with Article 17 GDPR, you have the right to request the erasure of your personal data stored by us, insofar as
  • they are no longer necessary for the purposes for which they were collected,
  • she revokes given consent and there is no other legal basis for processing the data,
  • if they object to the processing pursuant to Article 19(1) GDPR and there are no overriding legitimate grounds for the processing,
  • she objects to the processing pursuant to Art. 19 para. 2 GDPR,
  • the data were processed unlawfully,
  • the data must be deleted to fulfill a legal obligation,
  • the data were collected in accordance with Article 8(1) GDPR and the processing of the collected data is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
• to request the restriction of the processing of their personal data in accordance with Article 18 GDPR, insofar as
  • The accuracy of the data is disputed by her.
  • the processing is unlawful, but she refuses to have it deleted,
  • the controller no longer needs the data, but the data subject requires it for the establishment, exercise or defense of legal claims or
  • the data subject has objected to the processing pursuant to Article 21 GDPR;
• In accordance with Article 20 GDPR, to receive the personal data concerning them which they have provided to a controller in a structured, commonly used and machine-readable format or to request its transmission to another controller;
• According to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes this GDPR.

XI. Right of objection

If personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, the data subject has the right to object to the processing of their personal data pursuant to Article 21 GDPR, provided there are grounds relating to their particular situation or the objection is directed against direct marketing. In the latter case, the data subject has a general right to object, which we will respect without requiring the data subject to specify a particular situation.

If you wish to exercise your right of withdrawal or objection, simply send an email to info@palux.de.

XII. Updates and Changes to this Privacy Policy

This privacy policy is the currently valid version and is dated July 2019.

We reserve the right to amend this privacy policy in accordance with changing legal or regulatory provisions, due to the further development of our website, or due to our efforts to continuously improve this policy.

The current privacy policy can be accessed and printed at any time on our website at https://www.palux.de/datenschutz . The previous version can be found here.

XIII. Definitions

With the privacy policy we have published, we want to provide our customers, prospective customers and business partners with a transparent overview of the processing of personal data we carry out.

The privacy policy of PALUX Aktiengesellschaft is strictly aligned with the provisions of the General Data Protection Regulation and uses the terminology of this regulation.

To ensure the ease of reading this statement and to develop a uniform understanding of the terms used, we have listed the legal definitions of the most important terms below:

1) personal data
Personal data is any information relating to an identified or identifiable natural person (hereinafter the "data subject"). A natural person is considered to be identifiable who, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more special features, expresses the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person can be identified.

2) affected person
Concerned person is any identified or identifiable natural person whose personal data is processed by the controller.

3) Processing
Processing means any process or series of operations related to personal data, such as collecting, recording, organizing, arranging, storing, adapting or modifying, reading, querying, using, with or without the aid of automated procedures; disclosure by submission, dissemination or other form of provision, reconciliation or association, restriction, erasure or destruction.

4) Restriction of processing
Restriction of the processing is the marking of stored personal data with the aim to limit their future processing.

5) profiling
Profiling is any kind of automated processing of personal data that consists in using that personal information to evaluate certain personal aspects relating to a natural person, in particular aspects regarding analysing or predicting job performance, economic situation, health, personal preferences, interests, reliability, behavior, whereabouts or relocation of that natural person.

6) Pseudonymization
Pseudonymisation is the processing of personal data in such a way that personal data can no longer be attributed to a specific data subject without the need for additional information, provided that such additional information is kept separate and subject to technical and organizational measures to ensure that the personal data not assigned to an identified or identifiable natural person.

7) Controller or data controller
The controller or the person responsible for the processing is the natural or legal person, public authority, body or body that, alone or in concert with others, decides on the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for his designation may be provided for under Union or national law.

8) Processors
The processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the responsible party.

9) Recipient
Recipient is a natural or legal person, agency, institution or other entity to whom Personal Data is disclosed, whether or not it is a third party. However, authorities which may receive personal data under Union or national law in connection with a particular mission are not considered as beneficiaries.

10) third party
A third party is a natural or legal person, public authority, agency or institution other than the data subject, the controller, the processor and the persons authorized under the direct responsibility of the controller or the processor to process the personal data.

11) Consent
Consent is any voluntarily given and unambiguously expressed in the form of a statement or other unambiguous confirmatory act by the data subject for the particular case, by which the data subject indicates that they consent to the processing of the personal data concerning him / her is.

Competent supervisory authority: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart